CERT-In Directions of 28 April 2022: Who Must Report, What to Log, and What Happens If You Don't

What are the CERT-In Directions of 28 April 2022?

They are directions from CERT-In (No. 20(3)/2022-CERT-In) on "information security practices, procedure, prevention, response and reporting of cyber incidents". CERT-In issued them under section 70B(6) of the IT Act, which, as the Directions recite, empowers it to call for information and give directions to service providers, intermediaries, data centers, body corporate and any other person.

The Directions contain six numbered requirements and three annexures:

• (i) Time. Synchronize ICT system clocks to the National Informatics Centre (NIC) or National Physical Laboratory (NPL) time servers.
• (ii) Reporting. Report the incident types in Annexure I to CERT-In within 6 hours.
• (iii) Cooperation. Act on CERT-In orders and designate a Point of Contact.
• (iv) Logs. Enable ICT logs and keep them for a rolling 180 days within Indian jurisdiction.
• (v) Subscriber records. Specific record-keeping for data centers, VPS, cloud and VPN providers.
• (vi) Virtual assets. KYC and transaction records for virtual asset businesses.

Who do the CERT-In Directions apply to?

They apply to service providers, intermediaries, data centers, body corporate and Government organizations, plus the virtual asset businesses and VPS, cloud and VPN providers named in directions (v) and (vi). CERT-In's FAQ (Q7) says individual citizens are not covered.

The FAQ adds three scope points. Q25 uses the IT Act definition of body corporate: any company, including "a firm, sole proprietorship or other association of individuals engaged in commercial or professional activities". Q26 and Q28 say the Directions apply to any entity as far as cyber incident reporting is concerned. Q29 says providers without a physical presence in India that offer services to users there must designate a Point of Contact.

When did the Directions take effect?

The Directions say they "will become effective after 60 days from the date on which it is issued", meaning 60 days after 28 April 2022. CERT-In's notice of 27 June 2022 then set a later date for some entities.

• MSMEs. The Directions became effective on 25 September 2022 for micro, small and medium enterprises classified under the Ministry of MSME's notification S.O. 1702(E) of 1 June 2020.
• Subscriber validation. For data centers, VPS, cloud and VPN providers, only two items were deferred to 25 September 2022: "Validated names of subscribers/customers hiring the services" and "Validated address and contact numbers".

Which incidents must be reported, and how fast?

Report the incident types listed in Annexure I within 6 hours of noticing the incident or being told about it. The FAQ (Q24) adds that organizations need to deploy appropriate security controls and follow reasonable security practices to detect and prevent incidents.

Annexure I lists 20 types. They include targeted scanning of critical systems, compromise of critical systems or information, unauthorized access, website defacement or intrusion, malicious code (including ransomware and cryptominers), attacks on database, mail and DNS servers and routers, identity theft and phishing, DoS and DDoS attacks, attacks on SCADA and operational technology, application attacks, data breach, data leak, attacks on IoT devices, incidents affecting digital payment systems, malicious and fake mobile apps, unauthorized access to social media accounts, and attacks or suspicious activity affecting cloud, Big Data, blockchain, virtual asset, robotics, drone, and artificial intelligence and machine learning systems.

The FAQ (Q30) says an entity may report with the information it has at the time and add the rest later "within reasonable time". It also lists criteria for incidents that should go in within the 6-hour window, including data breaches or leaks and incidents affecting the safety of human beings.

Who reports when a vendor or partner is involved?

The entity that notices the incident reports it. The FAQ (Q13) says "The obligation of reporting of cyber incident is neither transferrable nor indemnified or dispense with", so a contract cannot move the duty to a partner. Q22 adds that the obligation is statutory and "overrides any confidentiality clause in any contract". If you outsource monitoring, settle in writing who will tell you the moment something is detected, because your 6 hours may run from the time you are told.

How do you contact CERT-In, and what is the Point of Contact?

The 2022 Directions print three reporting channels: email incident@cert-in.org.in, phone 1800-11-4949 and fax 1800-11-6969. They add that methods and formats are published on CERT-In's website "and will be updated from time to time", so confirm current channels there before an incident.

Covered entities must also designate a Point of Contact. Annexure II sets the format (name, designation, organization, address and contact numbers), sent to info@cert-in.org.in and updated as needed. The Directions say all CERT-In communications seeking information or giving directions go to that person.

What do the log and clock rules require?

Covered entities must "mandatorily enable logs of all their ICT systems and maintain them securely for a rolling period of 180 days", and the Directions say this must be "within the Indian jurisdiction". Logs must be provided to CERT-In with an incident report or when CERT-In orders it. Separately, clocks must sync to NIC or NPL time servers, or to servers traceable to them.

• Which logs. The FAQ (Q37) gives examples such as firewall, SIEM, web, database, mail, proxy, application, SSH and VPN logs, says the list is not exhaustive, and says both successful and unsuccessful events should be recorded.
• Where logs sit. Q35 says logs "may be stored outside India also as long as the obligation to produce logs to CERT-In is adhered to ... in a reasonable time". Q36 says a service provider offering services to users in India "needs to enable and maintain logs and records of financial transactions in Indian jurisdiction". The FAQ says it does not amend the law, so check the Directions' wording with counsel.
• Time sources. Organizations spanning multiple geographies may use another accurate, standard source if it does not deviate from NPL and NIC (direction (i) and Q41). Q43 lists samay1.nic.in, samay2.nic.in and time.nplindia.org.
• Time zone. Q40 says clocks need not be set to Indian Standard Time, but the time zone should be recorded.

What extra duties apply to data centers, VPS, cloud and VPN providers?

Direction (v) requires these providers to register accurate subscriber information and keep it for 5 years, or longer if the law requires, after cancellation or withdrawal of the registration. The seven items are:

• validated names of subscribers or customers
• period of hire, including dates
• IPs allotted to or used by the subscriber
• email address, IP address and time stamp at registration or onboarding
• purpose for hiring the services
• validated address and contact numbers
• ownership pattern of the subscribers or customers

What must virtual asset service providers keep?

Virtual asset service providers, virtual asset exchange providers and custodian wallet providers, as defined by the Ministry of Finance from time to time, must keep all KYC information and records of financial transactions for five years (direction (vi)). Transaction records must let each transaction be reconstructed, including IP addresses with time stamps and time zones, transaction ID, public keys or equivalent identifiers, the nature and date of the transaction and the amount.

What are the penalties for not complying?

The Directions say that failing to furnish information or not complying "may invite punitive action under sub-section (7) of the section 70B of the IT Act, 2000 and other laws as applicable". CERT-In's FAQ (para 4) quotes sub-section (7): a person who fails to provide information called for or comply with a sub-section (6) direction "shall be punishable with imprisonment for a term which may extend to one year or with fine which may extend to one lakh rupees or with both".

Q23 adds that the power "will be exercised reasonably and on occasions when the non-compliance is deliberate".

Have the Directions been amended or replaced, and how do they interact with the DPDP Act?

CERT-In's Directions page, opened on October 26, 2026, lists the Directions, the FAQs and the 27 June 2022 extension notice, and no later amendment or replacement. This is "not found", not proof that none exists, so check that page on the day you rely on it. This is general information, not legal advice.

On data protection, the Digital Personal Data Protection Rules, 2025 were published in the Gazette on 13 November 2025. Under Rule 1(4), Rules 3, 5 to 16, 22 and 23 come into force eighteen months after publication, so they were not in force on October 26, 2026. Two rules touch the same ground:

• Rule 6(1)(e) requires a Data Fiduciary to retain certain logs and personal data for one year to detect and investigate unauthorized access, "unless compliance with any law for the time being in force requires otherwise".
• Rule 7(2) requires intimation to the Data Protection Board without delay, and updated detail within 72 hours of becoming aware of a personal data breach (or a longer period the Board allows).

Does Purplecop help?

Purplecop Security's SOC-as-a-Service page describes "Round-the-clock monitoring, triage and escalation, every day of the year" and "Incident response and containment, with defined severities and response times." Its GRC & Compliance Advisory page describes a "Gap assessment against your target framework, with a prioritised remediation plan". Neither page mentions CERT-In, log retention or incident reporting, and neither makes the duties above anyone's but the covered entity's. If you want to discuss a specific obligation, use the contact page. Separate pages on this site cover RBI's cyber security directions and the IRDAI cyber security guidelines; this page does not say which instruments apply to you.

Who must report cyber incidents to CERT-In?

Service providers, intermediaries, data centers, body corporate and Government organizations must report the Annexure I incident types. Individual citizens are not covered, per the FAQ.

How quickly must an incident be reported to CERT-In?

Within 6 hours of noticing the incident or being brought to notice about it, per direction (ii). The FAQ allows partial information first.

How long must logs be kept?

For a rolling 180 days, maintained securely and within Indian jurisdiction, and provided to CERT-In with an incident report or on its order. CERT-In's FAQ discusses where copies may be stored, so read Q35 and Q36 alongside the Directions.

Do the Directions require NTP synchronization to NIC or NPL?

Yes: clocks of all ICT systems must connect to NIC or NPL NTP servers or servers traceable to them.

What is the penalty for non-compliance?

The Directions point to section 70B(7) of the IT Act and other laws. CERT-In's FAQ quotes 70B(7) as imprisonment up to one year, a fine up to one lakh rupees, or both.

Can Purplecop make my organization compliant with the CERT-In Directions?

No product or service can do that on its own, because the Directions place the duties on the covered entity. Purplecop's service pages do not name CERT-In or the Directions.